Dumping AR firmware?

Anyone got any idea how to dump the firmware of an AR via commslink? I tried using action.exe to dump the various cart address spaces (at both cached and uncached addresses), but I'm not getting anything...

I want to write a CD-based flash util for AR carts... I don't think I'll actually need to be able to dump the firmware though; I wanted to dump it so that I could do a test write to some nonessential region before overwriting the actual firmware, but I should be able to just alter a cheat code region to do that...